Warns at compile time when access and refresh tokens look like they are being stored in plaintext.
This is a warning, not an error: encrypting at rest is a judgement call that depends on your threat model, your database, and whether you already encrypt the whole volume. But it should be a deliberate judgement, and the default path of least resistance leaves live CDR credentials sitting in a table.
A refresh token here is unusually valuable. OpenFeed does not rotate them, and under the Recommended profile they live as long as the grant does — so one leaked row is durable access to somebody's banking data, not a short window. DPoP limits the damage, since an attacker also needs the signing key, which is a good argument for keeping the key somewhere other than the database.
Silence it once you have decided:
config :ash_openfeed, warn_unencrypted?: false